Understanding a Landing Zone
A landing zone is the foundational cloud environment an organization builds before migrating or deploying production workloads. Rather than provisioning a single account or subscription and adding security controls after the fact, a landing zone establishes the multi-account structure, identity federation, network topology, logging, and policy guardrails up front, so every new workload inherits a consistent, secure baseline from day one.
Core Components
- Account or subscription structure – a management account plus dedicated accounts for log archiving, security/audit, shared services, and individual workloads, often organized with AWS Organizations or Azure Management Groups.
- Identity federation – centralized authentication through AWS IAM Identity Center or Microsoft Entra ID, so users and roles are managed once and federated into every account rather than duplicated.
- Network topology – typically a hub-and-spoke design using AWS Transit Gateway or Azure Virtual WAN, with a central hub for shared services like DNS, firewalls, and VPN/Direct Connect or ExpressRoute connectivity.
- Guardrails – preventive and detective controls enforced through AWS Service Control Policies (SCPs) or Azure Policy, blocking actions like disabling logging, deploying to unapproved regions, or creating public S3 buckets.
- Centralized logging – CloudTrail, VPC Flow Logs, or Azure Activity Logs aggregated into a dedicated log archive account with restricted access.
- Account vending – an automated process, such as AWS Control Tower’s Account Factory, that provisions new workload accounts pre-configured with the guardrails and network connections already applied.
Example Scenario
An enterprise adopts AWS Control Tower to stand up its landing zone. It defines organizational units for security, infrastructure, and workloads, applies SCPs that block regions outside the company’s approved list and prevent CloudTrail from being disabled, and configures Account Factory so any new team requesting an AWS account automatically gets a pre-wired VPC connected to the central Transit Gateway, IAM Identity Center access, and log forwarding to the security account. A new application team can then request an account and start deploying within hours instead of weeks of manual security configuration.
Why Teams Build a Landing Zone
Landing zones exist to solve the problem of inconsistent security posture as cloud adoption scales across many teams. Without one, each team configures its own account from scratch, leading to configuration drift, inconsistent logging coverage, and security gaps that are expensive to remediate retroactively. A landing zone also contains blast radius: a compromised or misconfigured workload account is isolated from others by account boundaries and guardrails, and it accelerates onboarding because new teams don’t reinvent networking and identity each time.
Trade-offs and Limitations
Designing a landing zone requires real cloud architecture and governance expertise, and an over-engineered landing zone can slow down the very teams it’s meant to enable, adding weeks before the first workload can deploy. It also requires ongoing maintenance as the organization’s compliance requirements and service catalog evolve, and guardrails that are too permissive fail to prevent drift while ones that are too strict generate a stream of exception requests.
Best Practices
- Start with a minimal viable landing zone covering identity, logging, and core network guardrails, then iterate rather than trying to anticipate every control up front.
- Manage the landing zone itself as infrastructure as code, using Terraform, CloudFormation StackSets, or Azure Landing Zone Bicep modules, so it’s versioned and repeatable.
- Align the landing zone design with a cloud adoption framework’s governance and platform guidance rather than building guardrails ad hoc.
- Review and prune guardrails periodically based on audit findings and developer friction reports.
Frequently Asked Questions
What is Landing Zone?
A landing zone is a pre-configured, multi-account cloud environment with baseline networking, identity, logging, and security guardrails already in place, designed as the secure foundation new workloads deploy onto.
How does Landing Zone work?
Landing Zone works by combining the components described in the sections above. The main page walks through the architecture, the typical use cases, and the trade-offs to weigh before adopting it.
Why does Landing Zone matter?
Teams adopt Landing Zone to ship faster, run more reliably, and reduce the cognitive load on engineers. The benefits, limits, and adjacent tools are covered in the body above.
When should you use Landing Zone?
Use Landing Zone when the problems it solves match what your team is hitting today. The page above outlines the signals that mean you should adopt it now, and the cases where a simpler approach is fine.
